Your HR platform is hosted in Europe. Your customer support runs from India. Your backups sit in a data centre abroad. Each of these ordinary arrangements may involve moving personal data out of Kenya , and that is where the rules begin.
Can personal data be transferred outside Kenya?
Yes, but not freely. The Data Protection Act 2019 restricts transfers of personal data outside Kenya, permitting them only where specific conditions are met , such as appropriate safeguards, the data subject’s consent, or other grounds recognised under the Act. The restrictions apply whether data travels by file transfer, remote access, or simply being viewable from another country. The Office of the Data Protection Commissioner publishes guidance on when the conditions apply and how they are evidenced.
What should a business check before data leaves Kenya?
- Map the flows: which systems send personal data abroad, and to which countries.
- Identify the legal basis for each transfer, and document it.
- Put contractual safeguards in place with each receiving vendor.
- Check the vendor’s sub-processors , the onward chain matters as much as the first hop.
- Review hosting locations after every migration or acquisition.
Transfers also arise in everyday operations, not only in technology projects: sending a customer list to an overseas printer, sharing payroll data with a regional headquarters, or letting a consultant open records from abroad all count. The question is not whether the arrangement feels routine, but whether personal data crosses a border , and on what basis.
How do contracts carry the weight?
Because most transfers rest on safeguards rather than paperwork alone, the vendor agreement is where compliance lives or fails. The contract should identify the data, the destinations, the security commitments and what happens on termination, and it should be reviewed by someone who has read both the statute and the system architecture. Our contract lawyers regularly review such agreements. For groups with several entities and vendors, a governance review consolidates the transfer map and keeps it current as systems change , see our governance advisory services. The Act is available on Kenya Law.
For guidance on your specific situation, contact CS Advocates LLP , call, WhatsApp, or book a confidential consultation at our Westlands, Nairobi office.